Transcript PPT

Introduction to
Cryptographic Multilinear Maps
Sanjam Garg, Craig Gentry, Shai Halevi
IBM T.J. Watson Research Center
Dec 2013
Visions of Cryptography, Weizmann Inst.
1
Multilinear Maps (MMAPs)

A technical tool
◦ Think “trapdoor-permutations” or “smoothprojective-hashing”, or “randomized-encoding”
◦ More a technique than a single primitive
 Several different variants, all share the same core
properties but differ in details

Extension of bilinear maps [J00,SOK00,BF01]
◦ Bilinear maps are extensions of DL-based crypto
◦ Took the crypto world by storm in 2000, used in
dozens of applications, hundreds of papers
◦ Applications from IBE to NIZK and more
Dec 2013
Visions of Cryptography, Weizmann Inst.
2
DL/DDH and Bilinear Maps

Why is DDH such a “gold mine”?
◦ You can take values 𝑎𝑖 and “hide them” in 𝑔𝑎𝑖
◦ Some tasks are still easy in this representation
 Can compute any linear/affine function of the 𝑎𝑖 ’s,
and check if 𝑎𝑖 = 0
◦ Other tasks are seemingly hard
 E.g., computing/checking quadratic functions

Bilinear maps are similar: we can compute
quadratics, while cubics seem hard
 Turns out to be even more useful
Dec 2013
Visions of Cryptography, Weizmann Inst.
3
Why Stop at Two?

Can we find groups that would let us
compute cubics but not 4th powers?
◦ Or in general, upto degree 𝑘 but no more?
 Cryptographic multilinear maps (MMAPs)
◦ Even more useful than bilinear

[Boneh-Silverberg’03] explored some
applications of MMAPs
◦ Also argued that they are unlikely to be
constructed similarly to bilinear maps
Dec 2013
Visions of Cryptography, Weizmann Inst.
4
The [GGH’13] Approach

An “approximate” cryptographic MMAPs
◦ Degree-𝑘 functions, zero-test are easy
◦ Some degree-(𝑘 + 1) functions seem hard
◦ Enabling many new applications

Built using “FHE techniques”
◦ From a variant of the NTRU HE scheme

Another construction in [CLT’13]
◦ Using a variant of “HE over integers” instead
◦ All degree-(𝑘 + 1) functions seem hard
Dec 2013
Visions of Cryptography, Weizmann Inst.
5
This Talk

An overview of [GGH’13]
◦ Some details
◦ Which degree-(𝑘 + 1) functions are easy/hard
 Source- vs. target-group assumptions

Examples of using it:
◦
◦
◦
◦
(𝑘 + 1)-partite key exchange [J00,BS03]
Witness encryption [GGSW’13]
Full domain hash [FHPS’13, HSW’13]
Obfuscation (just a hint)
Dec 2013
Visions of Cryptography, Weizmann Inst.
6
THE [GGH’13]
CONSTRUCTION
Dec 2013
Visions of Cryptography, Weizmann Inst.
7
“Somewhat Homomorphic”
Encryption (SWHE) vs. MMAPs
SWHE
• Encrypting c𝑎 = E(𝑎)
 Computing low-deg
polynomials of the 𝑐𝑎 ’s
is easy
? Fuzzy threshold for
easy vs. hard?
Cannot test anything
MMAPs
• “Encoding” 𝑒𝑎 = 𝑔𝑎
 Computing low-deg
polynomials of the 𝑒𝑎 ’s
is easy
 Sharp threshold for
easy vs. hard
 Can test for zero
• But if you have skey you
can recover 𝑎 itself
Dec 2013
Visions of Cryptography, Weizmann Inst.
8
Main Ingredient: Testing for Zero

To be useful, we must be able to test if
two degree-𝑘 expressions are equal
◦ Using homomorphism, that’s the same as
testing if a degree-𝑘 expression equals zero

Our approach: augment a SWHE scheme
with a “handicapped” secret key
◦ Can test if a ciphertext decrypts to zero, but
cannot decrypt arbitrary cipehrtexts
 Assuming that the plaintext-space is large
◦ Called a “zero-test parameter”
Dec 2013
Visions of Cryptography, Weizmann Inst.
9
A Few Words About Levels

A “level-𝑘” ciphertext encrypts a
degree-𝑘 expression
◦ Fresh cipehrtexts, 𝑐𝑎 =Enc(𝑎), are at level 1
◦ 𝐿𝑒𝑣𝑒𝑙 𝑐 ⊠ 𝑐 ′ = 𝐿𝑒𝑣𝑒𝑙 𝑐 + 𝐿𝑒𝑣𝑒𝑙 𝑐 ′
◦ 𝐿𝑒𝑣𝑒𝑙 𝑐 ⊞ 𝑐 ′ = max{𝐿𝑒𝑣𝑒𝑙 𝑐 , 𝐿𝑒𝑣𝑒𝑙(𝑐 ′ )}

Contemporary SWHE schemes are
“naturally leveled”
◦ Often a ciphertext in these schemes would be
tagged with its level
Dec 2013
Visions of Cryptography, Weizmann Inst.
10
A Few Words About Levels (2)

A zero-test parameter that works for all
levels, would give a “black-box field”
◦ Could be useful, but it’s not MMAPs
◦ Also we don’t know how to get one

Our zero-test parameter only works for
ciphertexts at one particular level 𝑘
◦ The zero-test level is a parameter, equal to
the multi-linearity degree that we want to
implement
Dec 2013
Visions of Cryptography, Weizmann Inst.
11
Our Goal (“approximate MMAPs”)
𝑎𝑖 ‘s from some
large finite field/ring
𝒌-Graded Encoding Scheme
 KeyGen(𝑘): Generating public parameters
 Encode: level-1 encoding of plaintext 𝑎𝑖 ’s
◦ Plaintext 𝑎𝑖 ’s themselves are considered “level-0”
◦ Encoding can be randomized

Arithmetic: addition & multiplication
◦ 𝐿𝑒𝑣𝑒𝑙 𝑐 ⊠ 𝑐 ′ = 𝐿𝑒𝑣𝑒𝑙 𝑐 + 𝐿𝑒𝑣𝑒𝑙 𝑐 ′
◦ 𝐿𝑒𝑣𝑒𝑙 𝑐 ⊞ 𝑐 ′ = max{𝐿𝑒𝑣𝑒𝑙 𝑐 , 𝐿𝑒𝑣𝑒𝑙(𝑐 ′ )}

Zero-test: does 𝑐 encode 0?
◦ Only works for level-𝑘 encoding
Dec 2013
Visions of Cryptography, Weizmann Inst.
12
Some Variations
Can extract “random canonical representation”
of 𝑎 from any level-𝑘 encoding of 𝑎
 Can only encode random 𝑎𝑖 ’s, not specific ones
 KeyGen outputs a matching secret key

◦ Secret key may be needed for encoding

Encoding can be re-randomizable
◦ Given any level-𝑖 encoding of 𝑎, output a random level-𝑖
encoding of the same 𝑎

More complicated level structure than just 0,1,2, …
◦ E.g., levels are vectors, with partial ordering
◦ Yields an extension of “asymmetric maps”
Dec 2013
Visions of Cryptography, Weizmann Inst.
13
Overview of [GGH’13]

Start from an NTRU-like SWHE scheme
◦ Semantic-security under some “reasonable
assumptions”

Add zero-test parameter
◦ Some things that were hard now become easy
◦ Other things are still seemingly hard
 But hardness assumptions are stronger, uglier
◦ Separating hard from easy is challenging
Dec 2013
Visions of Cryptography, Weizmann Inst.
14
Starting From NTRU-like SWHE

All ops are in some polynomial rings
◦ 𝑅 = 𝑍[𝑋]/𝐹(𝑋), 𝑅𝑞 = 𝑅/𝑞𝑅

In NTRU 𝑔 = 3
Secret key is 𝑔, 𝑧 ∈ 𝑅𝑞
◦ 𝑔 is short (|𝑔| ≪ 𝑞), 𝑧 is random in 𝑅𝑞
◦ Plaintext elements are from 𝑅𝑔 = 𝑅/𝑔𝑅

An encryption of 𝑎 is 𝑐𝑎 = 𝑒𝑎 /𝑧
𝑞
◦ |𝑒𝑎 | ≪ 𝑞 and 𝑒𝑎 = 𝑎 (𝑚𝑜𝑑 𝑔)

To decrypt set 𝑎 ← 𝑐𝑎 ⋅ 𝑧
Dec 2013
𝑞
𝑚𝑜𝑑 𝑔
Visions of Cryptography, Weizmann Inst.
15
Homomorphic NTRU

Level-𝑖 encryption of 𝑎 is
(𝑖)
𝑐𝑎
= 𝑒𝑎 𝑧 𝑖
◦ |𝑒𝑎 | ≪ 𝑞 and 𝑒𝑎 = 𝑎(𝑚𝑜𝑑 𝑔)


𝑞
To decrypt set 𝑎 ← 𝑐𝑎 ⋅ 𝑧 𝑖 𝑞 𝑚𝑜𝑑 𝑔
Can add, multiply ciphertexts in 𝑅𝑞
◦
𝑖
𝑐𝑎
𝑖
+ 𝑐𝑏
𝑞
=
𝑧𝑖
𝑒𝑎 + 𝑒𝑏
𝑞
=
(𝑖)
𝑐𝑎+𝑏
 Because |𝑒𝑎 + 𝑒𝑏 | ≪ 𝑞 and 𝑒𝑎 + 𝑒𝑏 = 𝑎 + 𝑏 (𝑚𝑜𝑑 𝑔)
𝑖
𝑗
◦ 𝑐𝑎 ⋅ 𝑐𝑏
𝑞
= 𝑒𝑎 𝑒𝑏 𝑧 𝑖+𝑗
(𝑖+𝑗)
𝑞
= 𝑐𝑎𝑏
 Because |𝑒𝑎 𝑒𝑏 | ≪ 𝑞 and 𝑒𝑎 𝑒𝑏 = 𝑎𝑏 (𝑚𝑜𝑑 𝑔)

as long as numerator remains ≪ 𝑞
Dec 2013
Visions of Cryptography, Weizmann Inst.
16
The Public Key

Let 𝑓0 =
(1)
𝑐0
=
𝛼𝑔
,
𝑧
𝑓1 =
◦ |𝛼𝑔|, |𝛽𝑔 + 1| ≪ 𝑞
(1)
𝑐1
=
𝛽𝑔+1
𝑧
To encrypt a small 𝑚, choose small 𝑟, set
𝒓𝜶 + 𝒎𝜷 𝒈 + 𝒎
(𝟏)
𝒄𝒎 = 𝒓𝒇𝟎 + 𝒎𝒇𝟏 =
𝒛
 If 𝑚 is Gaussian with suitable parameter
then |𝑚| ≪ 𝑞 and 𝑚 is ~uniform mod 𝑔

◦ So we can encrypt random 𝑅𝑔 elements
◦ But not any pre-set element
Dec 2013
Visions of Cryptography, Weizmann Inst.
17
Zero-Test Parameter

Need to publish information to help
recognize elements of the form 𝒓𝒈/𝒛𝒌
◦ But not of the form (𝒓𝒈 + 𝒙)/𝒛𝒌
◦ Also not of the form 𝒓𝒈/𝒛𝒌′ for 𝑘 ′ > 𝑘

First idea: publish 𝒑𝐳𝐭 = 𝒛𝒌 /𝒈
◦ 𝑝𝑧𝑡 ⋅ 𝑟𝑔 𝑧 𝑘
𝑞
= 𝑟, with |𝑟| ≪ 𝑞
◦ But 𝑝𝑧𝑡 ⋅ 𝑟𝑔 + 𝑥 𝑧 𝑘 𝑞 = 𝑟 + 𝑥 𝑔 𝑞 ,
and 𝑥/𝑔 entails wraparound mod 𝑞
 So typically | 𝑟 + 𝑥 𝑔 𝑞 | ≈ 𝑞
Dec 2013
Visions of Cryptography, Weizmann Inst.
18
Zero-Test Parameter (2)

Main problem is that 𝑧 𝑘 /𝑔 enables also
zero-testing at levels > 𝑘
◦ E.g.,

𝑟𝑔
𝑧 2𝑘−1
⋅ 𝑓0 ⋅
𝑧𝑘
𝑔
2
= 𝑟 ⋅ 𝛼, |𝑟 ⋅ 𝛼| ≪ 𝑞
𝑞
To counter this, set 𝒑𝐳𝐭 = 𝒉 ⋅ 𝒛𝒌 /𝒈
◦ With |ℎ| ≈ √𝑞
◦ Now squaring 𝑝zt already yields wraparound

Zero-testing procedure:
◦ Check if | 𝑝𝑧𝑡 ⋅ 𝑐 𝑞 | < 𝑞 3/4
Dec 2013
Visions of Cryptography, Weizmann Inst.
19
Correctness of Zero-Testing

If c = 𝑟𝑔/𝑧 𝑘 encodes zero at level 𝑘 then
ℎ𝑧 𝑘 𝑔 ⋅ 𝑟𝑔 𝑧 𝑘 = ℎ𝑟 (mod 𝑞)
◦ We know that |𝑟𝑔| < 𝑞1/8 , since all valid
encodings have small numerators
◦ Hence also |𝑟| < 𝑞1/8+𝜖
 This assumes 𝑔−1 is small in the field of fractions
◦ Since |ℎ| < 𝑞1/2+𝜖 then |ℎ𝑟| < 𝑞3/4

ℎ𝑧 𝑘 𝑔 ⋅ 𝑟𝑔 𝑧 𝑘 𝑞 = ℎ𝑟 and |ℎ𝑟| < 𝑞 3/4
so the zero-test pass
Dec 2013
Visions of Cryptography, Weizmann Inst.
20
Correctness of Zero-Testing (2)
The converse is a bit more complicated:
 Let 𝑔, ℎ be such that the two ideals
𝑔𝑅, ℎ𝑅 are co-prime
Lemma: Let 𝑒 be s.t. |𝑒ℎ| < 𝑞/2 and let 𝑤 =
𝑒ℎ/𝑔 𝑞 . If 𝑤 is small enough, |𝑤𝑔| < 𝑞/2,
then 𝑒 ∈ 𝑔𝑅

◦ i.e., 𝑒 = 𝑔𝑟 for some 𝑟
Proof: 𝑤𝑔 = 𝑒ℎ over 𝑅 (since both < 𝑞/2)
and since ℎ, 𝑔 co-prime then 𝑔|𝑒.
Dec 2013
Visions of Cryptography, Weizmann Inst.
21
Correctness of Zero-Testing (3)
Lemma: Let 𝑒 be s.t. |𝑒ℎ| < 𝑞/2 and let
𝑤 = 𝑒ℎ/𝑔 𝑞 . If 𝑤 is small enough, |𝑤𝑔| <
𝑞/2, then 𝑒 ∈ 𝑔𝑅
Corollary: if 𝑒/𝑧 𝑘 is a valid level-𝑘 encoding
(|𝑒ℎ| < 𝑞/2) and it passes zero-test
(𝑤 is small), so it is an encoding of zero
Dec 2013
Visions of Cryptography, Weizmann Inst.
22
Security of Zero-Testing

This Zero-Test procedure provides
functionality, not security
◦ Easy to come up with an “invalid encoding”
that passes the zero test.

If we need security, publish many 𝑝𝑧𝑡 ’s
for many different mid-size ℎ’es
◦ Check | 𝑝𝑧𝑡 ⋅ 𝑐 𝑞 | < 𝑞 3/4 for all of them
◦ Can prove that whp over the ℎ’es, only valid
zero-encodings pass this test.
Dec 2013
Visions of Cryptography, Weizmann Inst.
23
What’s Hard
Some degree-𝑘 + 1 functions seem hard to
compute, or even test
Multilinear-DDH (MDDH)
 For 𝑘 + 1 level-1 encoding of random
(1)
(1)
elements, 𝑐𝑎0 , … , 𝑐𝑎𝑘 ,

(𝑘)
𝑐𝑏 ,
and another level-𝑘 encoding
 hard to distinguish 𝑏 = 𝑎0 ⋅ … ⋅ 𝑎𝑘 𝑚𝑜𝑑 𝑔
from random 𝑏

Dec 2013
Visions of Cryptography, Weizmann Inst.
24
What’s Not Hard

Other degree-𝑘 + 1 functions are easy
Multilinear-DDH’
 For 𝑘 + 1 level-1 encoding of random
(1)
(1)
elements, 𝑐𝑎0 , … , 𝑐𝑎𝑘 ,
(1)
𝑐𝑏 ,
and another level-1 encoding
 easy to decide if 𝑏 = 𝑎0 ⋅ … ⋅ 𝑎𝑘 (𝑚𝑜𝑑 𝑔)

Dec 2013
Visions of Cryptography, Weizmann Inst.
25
What’s the Difference?

A “target group” problem includes some
elements encoded at the highest level (𝑘)
◦ Such problems are seemingly hard in these
encodings

A “source group” problem includes only
elements encoded at levels ≤ 𝑘
◦ Include things like decision-linear assumption
◦ These problems are easy, assuming that we
indeed provide the public-key elements 𝑓0 , 𝑓1
Dec 2013
Visions of Cryptography, Weizmann Inst.
26
Why the Difference?

These encodings are subject to a “weak
discrete-logarithm” attacks. Given:
◦ Level-𝑖 encoding of some 𝑎, and
◦ Level-𝑗 encoding of 0 (e.g., 𝑓0 ), with 𝑖 + 𝑗 ≤ 𝑘

Can compute “in the clear” 𝑎′ ∈ 𝑎 + 𝑔𝑅
◦ I.e., 𝑎′ = 𝑎 + 𝑔𝑟 for some 𝑟

𝑎′ is not small, so you cannot re-encode it
at level 1 and break MDDH or similar
◦ But if you have 𝑔′ , 𝑎0′ , … , 𝑎𝑘′ and 𝑏′, you can
check whether 𝑏 ′ = 𝑎0′ ⋅ … ⋅ 𝑎𝑘′ mod 𝑔′
Dec 2013
Visions of Cryptography, Weizmann Inst.
27
Dealing with “Weak DL” Attacks

Some applications only rely on “target
group” assumptions
◦ Those are not affected by the attack
More applications can get by without
providing 𝑓0 , 𝑓1 , so attack does not apply
 Or use other MMAPs

◦ [CTL’13] seemingly not susceptible to weak-DL
◦ Can perhaps “immunize” [GGH’13] against it
 Using GGH-encoded matrices and their eigenvalues
Dec 2013
Visions of Cryptography, Weizmann Inst.
28
Computation Problems



The source/target distinction is about
decision problems
Computation problems have their own issues
Roughly speaking, anything that requires
division is hard
(𝑖)
(𝑗)
◦ But division in the ring 𝑅𝑞 is easy: from 𝑐𝑎1 , 𝑐𝑎2
𝑖
𝑗
we can compute 𝑑 = 𝑐𝑎1 𝑐𝑎2
𝑞
◦ 𝑑 is unlikely to be a valid encoding, can perhaps
be discarded using the “secure zero-test”
Dec 2013
Visions of Cryptography, Weizmann Inst.
29
APPLICATIONS OF
MMAPS
Dec 2013
Visions of Cryptography, Weizmann Inst.
30
Application I:
(𝑘 + 1)-partite key exchange




Public parameters include 𝑓0 , 𝑓1 , 𝑝𝑧𝑡
𝑃𝑖 draws small 𝑚𝑖 , 𝑟𝑖 , publishes the level-1
(1)
encoding 𝑢𝑖 = 𝑐𝑚𝑖 = 𝑟𝑖 𝑓0 + 𝑚𝑖 𝑓1
𝑃𝑖 computes level-𝑘 encoding of product
𝑠𝑖 = 𝑚𝑖 ⋅ ∏𝑗≠𝑖 𝑢𝑗
All parties have level-𝑘 encodings of the
same thing
◦ Indistinguishable from encoding of a random
element, under MDDH

How to get a shared secret key out of it?
Dec 2013
Visions of Cryptography, Weizmann Inst.
31
Extracting Canonical Representation

All of 𝑠0 , … , 𝑠𝑘 encode the same thing
 𝑝𝑧𝑡 𝑠𝑖 − 𝑝𝑧𝑡 𝑠𝑗
𝑞
= 𝑝𝑧𝑡 𝑠𝑖 − 𝑠𝑗
Roughly use MSBs of 𝑝𝑧𝑡 ⋅ 𝑠𝑖

𝑞
𝑞
is small ∀𝑖, 𝑗
as a shared key
Public params also include
◦ Seed 𝜎 of strong randomness extractor
◦ Random element 𝛿 ∈ R 𝑞

Shared key computed as
𝐾𝑖 = 𝑒𝑥𝑡𝜎 𝑀𝑆𝐵 𝛿 + 𝑝𝑧𝑡 ⋅ 𝑠𝑖
𝑞
◦ Whp over 𝛿, all 𝐾𝑖 ’s are equal
◦ Indistinguishable to observer from random bits
Dec 2013
Visions of Cryptography, Weizmann Inst.
32
Application II: Witness Encryption

“Encryption without any key”
◦ Relative to an arbitrary riddle
◦ Defined here relative to exact-cover (XC)
 Use NP-hardness to get any NP statement

Message encrypted wrt to XC instance
◦ Encryptor need not know a solution, or even
if a solution exists
Anyone with a solution can decrypt
 Semantic-security if no solution exists

Dec 2013
Visions of Cryptography, Weizmann Inst.
33
Recall Exact Cover
Instance: A universe [𝑛] and a collection
of subsets 𝑆𝑖 ⊂ [𝑛], 𝑖 = 1, … , 𝑚
 A solution: sub-collection of the 𝑆𝑖 ’s that
forms a partition of [𝑛], i.e.,

◦ Subsets are pairwise disjoint, and
◦ Their union is the entire [𝑛].
Dec 2013
Visions of Cryptography, Weizmann Inst.
34
The [GGSW13] Construction

On an XC instance (𝑛, 𝑆1 , … , 𝑆𝑚 ) and
a message 𝑀
◦ Use 𝑛-linear maps
◦ Choose 𝑛 random elements 𝑎1 , … , 𝑎𝑛
◦ For every subset 𝑆𝑖 = {𝑗1 , … , 𝑗𝑡 }, publish a
(𝑡)
level-𝑡 encoding 𝑐𝐴𝑖 of 𝐴𝑖 = 𝑎𝑗1 ⋅ … ⋅ 𝑎𝑗𝑡
(𝑛)
𝑐𝑈
◦ Use a level-𝑛 encoding
of 𝑈 = 𝑎1 ⋅ … ⋅ 𝑎𝑛
to encrypt, by publishing the ciphertext
(𝑛)
𝐶 = 𝑒𝑥𝑡𝜎 𝑀𝑆𝐵 𝛿 + 𝑝𝑧𝑡 ⋅ 𝑐𝑈
⊕𝑀
𝑞
Dec 2013
Visions of Cryptography, Weizmann Inst.
35
The [GGSW] Construction (2)
If 𝑆𝑖1 , … , 𝑆𝑖𝑘 is a solution, then multiplying
(𝑡𝑖 )
the corresponding 𝑐𝐴𝑖 ’s we get a level-𝑛
encoding of U, then we can decrypt
 Every non-solvable instance defines a
computational problem

◦ Distinguish a level-𝑛 encoding of 𝑈 from a
level-𝑛 encoding of random

We assume all these problems to be hard
◦ Is this a reasonable assumption to make?
Dec 2013
Visions of Cryptography, Weizmann Inst.
36
Application III: Full-Domain Hash

Consider the following hash function, 𝐻 ∶
0,1 ℓ → level-ℓ-encodings:
◦ Public version of Naor-Reingold PRF
◦ Let 𝑎1,0, 𝑎1,1 , 𝑎2,0, 𝑎2,1 , … , 𝑎ℓ,0 , 𝑎ℓ,1 be
random elements, and publish their level-1
(1)
encoding 𝒄 = {𝑐𝑎𝑖,𝑏 : 𝑖 = 1, … , ℓ, 𝑏 = 0,1},
𝐻𝑐 𝑋 =

(1)
𝑐𝑎1,𝑋
1
⊠
1
𝑐𝑎2,𝑋
2
…⊠
(1)
𝑐𝑎ℓ,𝑋
ℓ
What can you do with it?
Dec 2013
Visions of Cryptography, Weizmann Inst.
37
BLS-type Signatures [HWS13]

Use 𝑘 = ℓ + 1, publish also
(1)
𝑐𝑎𝑜
◦ 𝑎0 is the secret key

𝜎 = 𝑆𝑖𝑔 𝑋 = 𝑎0 × 𝐻𝑐 (𝑋)
◦ Level-ℓ encoding of an (ℓ + 1)-product

Verify using zero-test:
𝜎 ⊠ 𝑓1 =? =

1
𝑐𝑎𝑜
⊠ 𝐻𝑐 𝑋
Can be aggregated, made identity-based
Dec 2013
Visions of Cryptography, Weizmann Inst.
38
“Programmable” Hash Functions
[FHPS13]

For any fixed “basis” 𝑏1 , … , 𝑏𝑘 , 𝑏 ∗ (encoded
at level 1), can generate a random 𝑐 as
above with a trapdoor 𝑡𝑑 s.t.:
◦ Using 𝑡𝑑 we can find for any 𝑋 a “representation
of 𝐻𝑐 (𝑋) in this basis”
 𝐻𝑐 𝑋 = 𝛼𝑋 ⊠ 𝑏1 ⊠ ⋯ ⊠ 𝑏𝑘 + 𝐵𝑋 ⊠ 𝑏 ∗
 𝛼 at level zero, 𝐵 at level 𝑘 − 1
◦ Roughly, for all but a random 1/𝑝𝑜𝑙𝑦 fraction of
the 𝑋’es, we have 𝛼𝑋 = 0

This is useful for “partition-type” proofs of
security
Dec 2013
Visions of Cryptography, Weizmann Inst.
39
Obfuscation [GGHRSW13]

Goal: take an arbitrary circuit and “encrypt
it”, so that:
◦ Can still evaluate the result on any input
◦ But “not much else”

Formulating “not much else” is hard
◦ [BGIRSVY01] show that some natural
formulations cannot be met
◦ Also defined the weaker notion of
“indistinguishability Obfuscation” (iO):
◦ If 𝐶1 , 𝐶2 compute the same function, then
𝑂𝐵𝐹 𝐶1 ≈ 𝑂𝐵𝐹(𝐶2 )
Dec 2013
Visions of Cryptography, Weizmann Inst.
40
iO for 𝑁𝐶

1
Begin with a corollary of Barrington’s
theorem, we can recognize L ∈ 𝑁𝐶 1 via
matrix multiplication:
◦ 𝐶𝐿 represented by a sequence of matrices of
length exp 𝑑𝑒𝑝𝑡ℎ 𝐶𝐿
◦ Input 𝑥 determines a sub-sequence
◦ 𝑥 ∈ 𝐿 iff their product is the identity
Dec 2013
Visions of Cryptography, Weizmann Inst.
41
Obfuscating 𝐶𝐿

Randomize the matrices for 𝐶𝐿
◦ How to randomize is the hard part, need to
counter several attacks
Provide level-1 encoding of matrices
 To evaluate on 𝑥

◦ Choose a subset and multiply the encoding
◦ Use zero-testing to check for identity
Dec 2013
Visions of Cryptography, Weizmann Inst.
42
Security
Mostly heuristic, but supported by
generic-group arguments
 Every pair of circuits 𝐶1 , 𝐶2 , defines a
decision problem

◦ We assume that they are all hard

These are all source-group assumptions
◦ Since the matrices are encoded at level 1
◦ But we are not giving 𝑓0 , 𝑓1 , so the weak-DL
attack does not apply
Dec 2013
Visions of Cryptography, Weizmann Inst.
43
Summary

Can approximate cryptographic MMAPs
◦ Using SWHE with “handicapped secret key”
◦ Known constructions from NTRU, “integer HE”
◦ Can we do the same thing from other schemes?

Enabling many new applications
◦ But hardness assumptions are strong, “ugly”
◦ In desperate need of a coherent theory

Practical performance lacking
◦ Worse than the [Gen09] HE scheme
Dec 2013
Visions of Cryptography, Weizmann Inst.
44